How PoisonZero protects
PoisonZero runs on the same machine as your agent and acts on the change to a file, not the file at rest. Every change to a protected memory file is checked before it takes effect, and the result is one of three outcomes. This page is the behavior, not the model internals.
Where the protection sits
The unit of protection is the change, not the file:
- On the change: a file is only read, diffed and scored when it changes; nothing is judged at rest.
- Before it takes effect: the check runs at the moment of the write, not once at install.
- Local: the watcher and the evaluation run on the same machine as your agent.
What triggers a check
The watcher listens for filesystem events on the protected paths and evaluates only content that is created or written:
| Event | What happens |
|---|---|
| File created | Evaluated as a new change |
| File written or modified | The added content is diffed against the last clean state and evaluated |
| File removed or renamed | Not evaluated: removing content is not a poisoning vector |
The three outcomes
Every evaluated change ends in exactly one of three outcomes:
| Outcome | When | What PoisonZero does |
|---|---|---|
| Allow | The change is evaluated as harmless | The change is accepted and becomes the new clean state |
| Ask | The change is neither clearly safe nor a proven attack | The file is held in its last safe state and you are asked before it takes effect. For a file that is being created for the first time there is no earlier state, so declining moves the whole file into quarantine - reversibly |
| Roll back | The change is evaluated as a proven attack | The change is undone automatically and the file returns to its last clean state |
Rolling back is reversible
A roll-back never destroys content. The dangerous change is undone by restoring the last known-clean version, and the displaced content is kept, not deleted:
- Restore, not delete: the file is rewritten to its last clean state; the change is quarantined, held aside rather than erased.
- Recoverable: the displaced content is preserved verbatim, so a decision can always be undone.
- Logged: every outcome is written to the local audit trail - what changed, when, and why.
Read next
The exact set of watched files: what PoisonZero watches. The uncertain middle band: user confirmation prompts. The safe-by-default stance: fail-closed.
Protection that acts on the change, before your agent does.
Watched locally, scored before it takes effect, and every roll-back reversible. Free for Linux, macOS and Windows.
Sign me up